From: Paul Mackerras Date: Tue, 26 Jan 2021 03:14:42 +0000 (+1100) Subject: Merge pull request #230 from tisj/eap-mschapv2-refactor X-Git-Tag: ppp-2.5.0~88 X-Git-Url: https://git.ozlabs.org/?p=ppp.git;a=commitdiff_plain;h=5191399f5266bb595f03f5c4fee13153092e2baf;hp=6891c82b8987f08baa9a16a2a0ae93b511323ea5 Merge pull request #230 from tisj/eap-mschapv2-refactor EAP mschapv2 refactoring --- diff --git a/pppd/chap-new.c b/pppd/chap-new.c index ad2f5eb..10e4507 100644 --- a/pppd/chap-new.c +++ b/pppd/chap-new.c @@ -171,11 +171,11 @@ chap_register_digest(struct chap_digest_type *dp) */ struct chap_digest_type * chap_find_digest(int digest_code) { - struct chap_digest_type *dp = NULL; + struct chap_digest_type *dp = NULL; for (dp = chap_digests; dp != NULL; dp = dp->next) if (dp->code == digest_code) break; - return dp; + return dp; } /* @@ -222,9 +222,8 @@ chap_auth_peer(int unit, char *our_name, int digest_code) error("CHAP: peer authentication already started!"); return; } - for (dp = chap_digests; dp != NULL; dp = dp->next) - if (dp->code == digest_code) - break; + + dp = chap_find_digest(digest_code); if (dp == NULL) fatal("CHAP digest 0x%x requested but not available", digest_code); diff --git a/pppd/eap.c b/pppd/eap.c index 7914655..342d91f 100644 --- a/pppd/eap.c +++ b/pppd/eap.c @@ -64,10 +64,6 @@ #include "md5.h" #include "eap.h" -#ifdef CHAPMS -#include "chap_ms.h" -#endif - #ifdef USE_SRP #include #include @@ -82,10 +78,12 @@ #ifdef USE_EAPTLS #include "eap-tls.h" #endif /* USE_EAPTLS */ + #ifdef CHAPMS -#include "magic.h" #include "chap_ms.h" #include "chap-new.h" + +extern int chapms_strip_domain; #endif /* CHAPMS */ eap_state eap_states[NUM_PPP]; /* EAP state; one for each unit */ @@ -223,7 +221,8 @@ eap_init(int unit) esp->es_client.ea_using_eaptls = 0; #endif /* USE_EAPTLS */ #ifdef CHAPMS - esp->es_client.digest = chap_find_digest(CHAP_MICROSOFT_V2); + esp->es_client.digest = chap_find_digest(CHAP_MICROSOFT_V2); + esp->es_server.digest = chap_find_digest(CHAP_MICROSOFT_V2); #endif } @@ -719,92 +718,6 @@ eap_figure_next_state(eap_state *esp, int status) } #if CHAPMS -static int -eap_chapms2_verify_response(int id, char *name, - unsigned char *secret, int secret_len, - unsigned char *challenge, unsigned char *response, - char *message, int message_space) -{ - unsigned char md[MS_CHAP2_RESPONSE_LEN]; - char saresponse[MS_AUTH_RESPONSE_LENGTH+1]; - int challenge_len, response_len; - - challenge_len = *challenge++; /* skip length, is 16 */ - response_len = *response++; - if (response_len != MS_CHAP2_RESPONSE_LEN) - goto bad; /* not even the right length */ - - /* Generate the expected response and our mutual auth. */ - ChapMS2(challenge, &response[MS_CHAP2_PEER_CHALLENGE], name, - (char *)secret, secret_len, md, - (unsigned char *)saresponse, MS_CHAP2_AUTHENTICATOR); - - /* compare MDs and send the appropriate status */ - /* - * Per RFC 2759, success message must be formatted as - * "S= M=" - * where - * is the Authenticator Response (mutual auth) - * is a text message - * - * However, some versions of Windows (win98 tested) do not know - * about the M= part (required per RFC 2759) and flag - * it as an error (reported incorrectly as an encryption error - * to the user). Since the RFC requires it, and it can be - * useful information, we supply it if the peer is a conforming - * system. Luckily (?), win98 sets the Flags field to 0x04 - * (contrary to RFC requirements) so we can use that to - * distinguish between conforming and non-conforming systems. - * - * Special thanks to Alex Swiridov for - * help debugging this. - */ - if (memcmp(&md[MS_CHAP2_NTRESP], &response[MS_CHAP2_NTRESP], - MS_CHAP2_NTRESP_LEN) == 0) { - if (response[MS_CHAP2_FLAGS]) - slprintf(message, message_space, "S=%s", saresponse); - else - slprintf(message, message_space, "S=%s M=%s", - saresponse, "Access granted"); - return 1; - } - - bad: - /* - * Failure message must be formatted as - * "E=e R=r C=c V=v M=m" - * where - * e = error code (we use 691, ERROR_AUTHENTICATION_FAILURE) - * r = retry (we use 1, ok to retry) - * c = challenge to use for next response, we reuse previous - * v = Change Password version supported, we use 0 - * m = text message - * - * The M=m part is only for MS-CHAPv2. Neither win2k nor - * win98 (others untested) display the message to the user anyway. - * They also both ignore the E=e code. - * - * Note that it's safe to reuse the same challenge as we don't - * actually accept another response based on the error message - * (and no clients try to resend a response anyway). - * - * Basically, this whole bit is useless code, even the small - * implementation here is only because of overspecification. - */ - slprintf(message, message_space, "E=691 R=1 C=%0.*B V=0 M=%s", - challenge_len, challenge, "Access denied"); - return 0; -} - -static struct chap_digest_type eap_chapms2_digest = { - CHAP_MICROSOFT_V2, /* code */ - NULL, /* chapms2_generate_challenge, */ - eap_chapms2_verify_response, - NULL, /* chapms2_make_response, */ - NULL, /* chapms2_check_success, */ - NULL, /* chapms_handle_failure, */ -}; - /* * eap_chap_verify_response - check whether the peer's response matches * what we think it should be. Returns 1 if it does (authentication @@ -961,10 +874,9 @@ eap_send_request(eap_state *esp) #ifdef CHAPMS case eapMSCHAPv2Chall: - challen = 0x10; + esp->es_server.digest->generate_challenge(esp->es_challenge); + challen = esp->es_challenge[0]; esp->es_challen = challen; - esp->es_challenge[0] = challen; - random_bytes(&esp->es_challenge[1], challen); PUTCHAR(EAPT_MSCHAPV2, outp); PUTCHAR(CHAP_CHALLENGE, outp); @@ -2500,6 +2412,12 @@ eap_response(eap_state *esp, u_char *inp, int id, int len) #ifdef CHAPMS case EAPT_MSCHAPV2: info("EAP: peer proposes MSCHAPv2"); + /* If MSCHAPv2 digest was not found, NAK the packet */ + if (!esp->es_server.digest) { + error("EAP MSCHAPv2 not supported"); + eap_send_nak(esp, id, EAPT_SRP); + break; + } esp->es_server.ea_state = eapMSCHAPv2Chall; break; #endif /* CHAPMS */ @@ -2629,6 +2547,14 @@ eap_response(eap_state *esp, u_char *inp, int id, int len) (remote_name[0] != '\0' && vallen == len)) strlcpy(rhostname, remote_name, sizeof (rhostname)); + /* strip the MS domain name */ + if (chapms_strip_domain && strrchr(rhostname, '\\')) { + char tmp[MAXNAMELEN+1]; + + strcpy(tmp, strrchr(rhostname, '\\') + 1); + strcpy(rhostname, tmp); + } + if (chap_verify_hook) chap_verifier = chap_verify_hook; else @@ -2638,7 +2564,7 @@ eap_response(eap_state *esp, u_char *inp, int id, int len) if ((*chap_verifier)(rhostname, esp->es_server.ea_name, id, - &eap_chapms2_digest, + esp->es_server.digest, esp->es_challenge, inp - 1, response_message,